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(54) Electronic combination lock 

(57) An electronic combination lock (12) has the 
capability of generating an opening combination by com- 
bining data read from an electronic key (16) and data 
unique to the lock (12) and stored in the lock. The key 
(16) may also include a clock circuit and memory, so that 
the lock (12) may read log the time of its opening and 
closing and the details of the user without needing to run 
a clock itself. The lock may be operated in a mode that 
requires two combinations and two separate keys (16) 
to open it. This mode is possible in several classes of 



operation such as Route, First Line Maintenance or Bank 
Mode. The lock (12) also has a mode of operation 
whereby it may be shelved or returned to a factory mode 
by using a unique combination and a one-time use key 
(16) for assistance whenever combinations are severely 
out of synchronization with a dispatching computer and 
without other correction options/The lock may also dis- 
able a silent alarm when correctly opened. 



FIG. 1 
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Description 

This invention relates to electronic combination 
locks and more specifically to combination locks which 
self generate their combinations. 

Electronic combination locks are known that use 
data uniquely associated with a particular lock to gener- 
ate a unique combination to open the lock. An authorized 
combination is provided to service personnel by a dis- 
patch computer which mimics the processor of the lock 
control to determine the combination to be accepted 
whenever the lock control actually generates the combi- 
nation. For an example of a lock which generates its com- 
bination for comparison with a combination similarly 
generated by a separate computer for dispatching pur- 
poses, reference is made EP-A-0649957 (USSN 
08/139,450 filed 20 October 1993). 

The lock combination is a mathematical combination 
of such numbers or values that are uniquely associated 
with a particular lock such as the lock serial number, the 
last opening combination, a master combination, and the 
seal count indicating the number of times the lock has 
been opened. 

It is advantageous both to identify the operator 
entering the lock and further to identify and log the date 
and tome of entry as well as the date and time of closing. 

Locks of the type which serf-generate power through 
operation of a lock component, such as a dial or lever, 
generally use capacitors to store the electrical energy 
necessary for operation of the lock but cannot store suf- 
ficient energy to power a clock at all times to accurately 
date and time log each entry because the clock must run 
continuously and, therefore, consumes electrical power. 
An example of a lock that generates its own operating 
power is co-pending U.S. Patent Application Serial 
Number 08/286,193, filed June 29, 1994 by Gerald L 
Dawson et al. and entitled ELECTRONIC COMBINA- 
TION LOCK WITH TIME DELAY FOR OPENING. 

The security of a lock is only as secure as the per- 
sonnel operating the lock. If a lock is left unlocked so that 
the operator may return at a later time and remove the 
contents of the container without having to operate the 
lock, security has-been compromised. By incorporating 
into the lock a feature that provides the operator with an 
indicator that the lock has been relocked and that indi- 
cator is required to be reported or conveyed to the dis- 
patcher of the combinations for the lock and the indicator 
is an essential element of data that must be provided to 
the lock to open it the next time, security is improved. An 
example of a lock that provides an indication of the lock- 
ing thereof is EP-A-0668423 (USSN 08/1 98,835 filed 18 
February 1994). 

In one aspect, it is an object of the invention to pro- 
vide a lock which self -generates its power, and which is 
able to log its usage. This is achieved by providing a lock 
which uses a unique electronically readable coded key, 
as detailed in the claims. 

Preferably, the lock uses a one-time self-generated 
combination, and verifies both the identity of the user and 



the type of user with a unique electronically readable 
coded key. 

Preferably, an operational mode is provided 
whereby each category of users may be required to enter 
5 at least two combinations and use two identifying keys. 
Further preferably, the lock permits the entry of a 
special combination and the use of a one-time specifi- 
cally coded electronically readable key to open the lock 
in the event the dispatching computer and the lock have 
10 become unsynchronized and the previously dispatched 
combination fails to open the lock. 

The invention may also extend to the use of an elec- 
tronic key in locks in general, not necessarily' limited to 
those which generate their own power, the lock being 
15 able to read information from the key to for example gen- 
erate a lock combination. 

The invention also provides in a further aspect an 
override for a (preferably silent) alarm on an outer build- 
ing when a lock is properly operated to gain entry. 
20 Embodiments of the present invention will now be 
described, by way of example only, with reference to the 
accompanying drawings, in which: 
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Rg. 1 is an illustration of an embodiment of a lock of 
the type incorporating the present invention; 
Fig. 2 is an illustration of another embodiment of the 
lock illustrated in Fig. 1; 

Fig. 3 is a schematic diagram of the lock of Figs. 1 
and 2; 

Figs. 4A and 4B are portions of the logic control flow 
diagrams for the lock of Figs 1 and 2; 
Figs. 5, 6, 7, 8A and 8B, are logic flow diagrams for 
portions of the logic and control operations in Figs. 
4A and 4B; 

Figs 9A, 9B and 9C are logic flow diagrams which 
illustrate how keypad inputs are processed by the 
lock; 

Figs. 10 and 1 1 are logic flow diagrams which illus- 
trate selected portions of the logic flow diagram in 
Fig. 9B; 

Figs. 12Aand 12B illustrate operation 124 of Fig. 4B. 
Figs. 13A and 13B illustrate operation 180 of Fig. 7; 
Figs. 14A and 14B illustrate operation 470 which is 
a common routine for operations 440, 458 and 464 
of Fig. 13B; 

Figs. 15A and 15B illustrate operation 508 of Rg 
14B; 

Rg. 16 illustrates operation 336 of Fig. 10. 
Rgs. 17A and 17B illustrate operation 452 of Rg. 
13B; 

Rgs. 18A and 18B illustrate operation 174 of Fig. 7; 
Fig. 19 illustrates operation 702 of Fig, 18B; 
Figs. 20A and 20B illustrate operation 710 of Rg 
18B; 

Fig. 21 illustrates operation 706 of Fig. 18B; and 
Rg. 22 illustrates operation 186 of Fig. 7. 

The lock 12, illustrated in FIG. 1 f is provided with a 
power generation apparatus 34 (in Fig. 3) and a dial knob 
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8 attached thereto for generating power for lock opera- 
tion. Manual operation of the knob or dial 8 rotates a step- 
per motor shaft (not shown) to generate raw alternating 
current voltage pulses which are electrically treated to 
provide the power for storage and for lock operation. 5 

The lock 12 of the subject invention has various 
operational attributes which are made possible by the 
inclusion of an electronic key 16 in the control (not 
shown). The key 1 6 is a canister which contains a clock 
circuit, a battery, and a memory which may be addressed 10 
for reading and writing in order to retrieve and store data. 

Whenever the lock 12 is powered with the capacitor 
(not shown) charged, all commands to operate the lock 
12, including the necessary information for lock 12 ini- 
tialization and combination entry, are provided to the lock 15 
control by depressing key buttons "0-9" on the touch key- 
pad 10 on lock 12. 

In a first embodiment, the lock 12, prior to being 
used, is initialized in a manner much the same as the 
Mas-Hamilton Group X-07 lock, whereby the lock 12 in 20 
an unlocked state is powered with a change key 48 (see 
Fig. 3) inserted into the lock 12. The display 14 will dis- 
play an EC to request entry of the factory combination; 
and thereafter, the display 14 will show ES to indicate 
that the entry of the serial number of the lock 12 is 25 
required. The display 14 then will show EC to indicate 
the entry of the customer number is required. 

After entry of the customer number, the lock 12 will 
display the customer number three times for verification 
and then display PO to instruct the operator to pull the 30 
change key 48 out of the lock 12. 

Thereafter, the display 1 4 will request the customer 
number for confirmation by displaying CC; and if entered 
correctly, the lock logic control will end the initialization 
with a display of EO for end operation on display 14. 35 

At any time after initialization, the lock combination 
may be entered. The lock combination entry will cause 
the display of IPI to instruct the operator to "insert per- 
sonal identifier/ which is electronic key 16 into the key 
socket 18. Electronic key 16 is as described above. 40 

The lock logic control reads the memory of the key 
1 6 to determine the serial or identifier number of the key 
16 which is permanently and unchangeably contained 
within the key memory. Thereafter if the authorized com- 
bination is correct, the display shows OPr, to indicate the 45 
lock 12 is openable by turning the dial or knob 8 to the 
right (clockwise). 

To close the lock 12, the lock knob 8 is turned left 
(counterclockwise) to extend the bolt 20 and also to con- 
tinue to generate power if the lock 12 has gone dead so 
while standing open. The display 14 will show IPI for 
"Insert Personal Identifier" and at the time the key 16 is 
inserted, then will display the close seal number. The 
close seal number may be used to verify that the lock 12 
in fact was closed and locked. 55 

The lock 12 can be provided with dual paths of oper- 
ation to permit both single or dual combination use. The 
keys 16 may be assigned to particular individuals and 
will be coded to indicate whether the key 1 6 is a first line 



maintenance (FLM) key, a route key, or a bank key. Dur- 
ing initialization, an opportunity to select the mode of 
operation may be presented prior to the entry of the cus- 
tomer number. A display of SL, indicating "select" is dis- 
played and a mode number then may be entered: 1 for 
single combination operation; 2 for dual combination 
mode operation; 3 for route mode operation; etc. 
Because both FLM personnel and route personnel may 
require entry to an automated teller machine (ATM), the 
apparatus most commonly considered for use of this 
. type of lock, separate paths of operational control exist 
within the lock 12. 

If initialized for dual combination operations, the 
operation of the lock 12 requires not only both entries of 
one combination and one personal identifier but must be 
then followed by entries of the second combination and 
second personal identifier before the lock 1 2 will be ena- 
bled to open. 

The route mode of operation essentially is identical 
to the FLM mode except for its own unique set of data to 
operate and to generate the combinations. Distinctive 
encoding identifies each level of authorization and the 
other variable data. 

Each authorized combination is generated in the 
lock 12 by mathematically combining the raw combina- 
tion, the key identifier or serial number of the key 1 6, the 
personal identifier, and the lock serial number along with 
the seal count of the lock 12. The raw combination is 
determined with the use of the key 16 by a dispatch com- 
puter which uses the same factors used by the lock 12 
which, accordingly, relate uniquely to that individual lock 
12. The seal count is the count of the number of times 
that the lock 12 has been opened or the seal has been 
broken. 

This unique authorized combination then is provided 
by a dispatcher to the person who will be operating the 
lock 12 in order to enter the enclosure which typically 
contains an automated teller machine (ATM). 

Thus, several keys 16 may be used either individu- 
ally or in pairs to access the lock 12; note, however, each 
key 16 will have different combinations. Always remain- 
ing in the possession of the operator, the individual key 
16 provides at least three of the elements of the data 
required for use: a key identifier/personal identifier, a 
company identifier, authorized level of use, i.e., FLM, 
route, bank or supervisor; and the raw authorized com- 
bination for use in the bank mode, all of which are 
encrypted except for the key identifier. 

In the bank mode of operation, the lock 12 may be 
opened by entry of the actual combination which is cre- 
ated by combining the raw combination with both a com- 
pany identification number and a key 
identification/personal identification number. Multiple dif- 
ferent raw combinations may be effective to open the lock 
12. each usable with its own electronic key 16. 

Due to the distinctive encoding of bank key authori- 
zation of the electronic key 16. the lock 12 recognizes 
the electronic key 1 6 as a bank key and uses a separate 
control path applicable to bank key operations through 
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the control of the microprocessor 30 of the lock 12. For 
bank key operations, the actual bank combination 
remains fixed for the lock 12 until such time as the com- 
bination is manually changed. 

Electronic keys 16 may be provided with an expira* s 
tion time (specified number of hours after encoding) to 
prevent use except within a preset time window as in the 
case of bank or alternate route keys. Alternate route keys 
16 cause the lock 12 to operate in an alternate route 
mode which is essentially the same as the bank mode 10 
except that actual combinations are fixed. Upon expira- 
tion of the key 16, the key 1 6 must be re-encoded in order 
to function further in lock 12. 

The lock 12 additionally is provided with software 
which stores the date and time, personal identifier, and is 
close seal number of both openings and closings in the 
nonvolatile memory of the lock 1 2 as well as in the mem- 
ory of the key 16. The information stored in the key 16 
audit trail memory is used to update the dispatch com- 
puter in order to keep the computer in synchronization 20 
with the lock 12. 

Further, in the first embodiment of the lock, the lock 
casing 22 (located on the inside of the security enclo- 
sure) is provided with an RS-232 data communications 
port 24. This allows printout of the audit trail memory to 25 
form a hard copy which lists dates, times, personal iden- 
tifiers, and close seal numbers for each opening and 
closing of the lock 12 to authorized personnel. The sec- 
ond embodiment of the lock does not have an RS-232 
data communications port, but rather relies on the key 30 
socket 1 8 and key 1 6 for the collection of the audit data, 
as wili be described below. 

Fig. 2 shows an alternative design for the front hous- 
ing of the lock 12 and is preferred for the second embod- 
iment but is, in other respects, substantially identical to 35 
the lock 12 illustrated in Fig. 1. 

Fig. 3 illustrates diagrammatically the electro- 
mechanical and electronic portions of the lock 12. Key- 
pad 10 is connected to the microprocessor 30 to input 
data to the lock 12, such as combinations and lock com- 40 
mands. The microprocessor 30 is powered, as are other 
electrical components, by the manual rotation of a dial 8 
which drives a generator 34 connected to a power supply 
32. The microprocessor 30 is provided with data storage 
in the form of an EEPROM 42 and on board RAM mem- 45 
ory 44, and includes a buffer 46. Display '1 4 is also con- 
nected to the microprocessor 30 to provide visual 
representations of some of the microprocessor 30 out- 
put. 

The microprocessor 30 is further connected to an so 
electronic key socket 1 8 for reading and writing data from 
and to the key or Touch Memory 16. 

The microprocessor 30 controls the lock release 
through an electrical control 36 such as a solenoid, step- 
per motor or similar device, which then enables a bolt ss 
withdrawal mechanism 38 to pull bolt 20. The dial 8 is 
capable of transferring manual input to the bolt with- 
drawal mechanism 38 as depicted by dashed line 40. 



A program to control the microprocessor of the lock 
system may be written by a programmer of ordinary skill 
in the art, taking the functions desired and incorporating 
them into the control program using a language compat- 
ible with the installed microprocessor. The microproces- 
sor of the lock is preferably an Intel 8051 or equivalent, 
and the requirements for writing in the language neces- 
sary for the Intel 8051 are readily available from Intel Cor- 
poration, Santa Clara, California, and well known to 
programmers skilled in the art. Microprocessors of other 
manufacturers may be used. 

So long as the other configuration requirements of 
a microprocessor are sufficient to satisfy the design 
requirements of the lock, the selection of an alternative 
microprocessor may be made by one skilled in the art. 

A detailed discussion of the logic flow which controls 
the microprocessor 30 follows with references to Figs. 4 
through 22. 

The overall operation of the lock 1 2 will be described 
with reference to Figs. 4A and 4B which illustrate the 
main line flow of the logic control of the lock 12 from the 
time that the lock 12 is receiving sufficient power from 
the generator 34 and power supply 32 until the lock 12 
has proceeded through the initialization process and the 
system checks. The operator is then prompted either to 
enter his combination or select a Special Menu choice. 
The keypad entries are processed by background inter- 
rupt driven routines within the lock's code. 

To understand the processing operations of the 
microprocessor 30, reference is made to Fig. 4, com- 
prised of Figs. 4A and 4B, illustrating the logic flow of the 
computer operation. Processing starts at START, oper- 
ation 100, when the dial 8 of the lock 12 is rotated suffi- 
ciently to power up the lock 12, to test and set up the 
microprocessor 30 for operation, and the microproces- 
sor 30 performs its standard Power On Reset (POR) 
sequence of operations. Thereafter, a counter desig- 
nated Total-Trys Counter is cleared in operation 102 and 
is used to keep track within one power up session of the 
number of total errors in operating the lock 12 to gain 
entry. 

Following operation 102 to clear the Total-Trys 
Counter, the lock hardware and working registers of the 
microprocessor 30 are initialized in operation 104 and 
the LCD display 14 of the lock 12 is cleared in operation 
106. Thereafter, the microprocessor 30 will test for the 
condition of one revolution of the dial 8 in the same direc- 
tion plus one-half revolution in either direction at opera- 
tion 108. In the event that this condition is not met, the 
NO path will lead to a Watch Dog TimeOut (WDTO) oper- 
ation. A WDTO operation 110 merely times out a period 
of unchanging conditions, a time delay of preferably 
about 40 seconds, during which time the operator has 
the opportunity to turn the dial 8 of the lock 12 one rev- 
olution in one direction and a one-half revolution in either 
direction, in the event that the dial 8 is not turned, then 
the WDTO win expire after 40 seconds and will cause the 
operation of microprocessor 30 to return to the START 
function at operation 112. After operation 112, the lock 



«-EP 07 1 2983A2 J_> 



7 



EP 0 712 983 A2 



8 



12 is re-initialized at operation 104; effectively, the lock 
12 restarts from its initial conditions, once again pre- 
pared to receive operator input. 

Returning to operation 1 08, in the event that the one 
and one-half revolutions previously referred to is s 
detected, then at operation 114, the silent alarm flag is 
checked; and if it has been set, from the previous ses- 
sion, the silent alarm message "ALS" is provided to the 
operator on the LCD 14 of the lock 12, and the silent 
alarm and its relay are cleared or reset: Thereafter in io 
operation 116. the change key port is checked to see if 
the change key is present and the change key flag is 
either set or not set depending on other conditions, as 
discussed with respect to Fig. 5 below. 

After operation 116, the lock 12 is tested to deter- 75 
mine whether it is in Factory Mode at decision block 118; 
a YES determination will cause the shunt relay 50 to turn 
off in operation 120. 

In some environments the lock 12 may be installed 
on a vault or container that is housed within a small build- 20 
ing or kiosk to provide it shelter from the elements. One 
very prominent example of such an installation occurs if 
the lock is installed on a vault containing an Automated 
Teller Machine (ATM) and the ATM is installed within a 
kiosk or a dedicated small room, referred to hereafter as 25 
an outer building. The outer building has a door which is 
locked, and the door may be provided with a device which 
completes a circuit or sends a signal whenever the door 
is open. This type of signal is a silent alarm sent to a 
monitoring station and alerts the watchman that the exte- 30 
rior door to the outer building has been opened. Many of 
the alarm systems of this type are provided with a device, 
such as a key lock or a keypad, that the user must use 
to disable the alarm. 

Especially with respect to the ATM installations, typ- 35 
ical field practice is to ignore the silent alarm system 
upon entering the outer building if the time within the 
outer building is expected to be short. An alarm is trig- 
gered and the watchman must wait a period of time to 
see if the door is promptly closed and thereby shut off 40 
the alarm. 

This waiting or ignoring of the alarm creates a seri- 
ous security breach and also lulls the watchman into a 
position to possibly ignore any signal should there be an 
intruder. 45 

The shunt relay 50 or alarm relay 50 in Fig. 3 is con- 
nected to microprocessor 30 and to the alarm connector 
52. Alarm connector 52 is a conventional connector to 
which the alarm circuit of the monitoring station may be 
connected. The microprocessor 30 controls the shunt so 
relay 50 in response to the entry of a valid combination 
and effectively disconnects the portion of the alarm cir- 
cuit connected to the door. Thus the shunt relay 50 will 
replace the override devices presently installed and elim- 
inate the need for a user to disable the silent alarm upon 55 
entry This eliminates false alarms because the silent 
alarm is shunted or shut off upon the entry of a valid com- 
bination and the insertion of a valid key 16, thereby open- 
ing the lock 12 and turning on the shunt relay 50. 



When the user finishes and locks the lock 1 2, the 
shunt relay 50 will be turned on and the alarm will sound 
at the monitoring station until the door to the outer build- 
ing is closed. Thus any extended silent alarm will alert 
the watchman that an intruder has entered the outer 
building but has not been able to enter the vault; and the 
watchman then may assume the intruder is not an 
authorized user and then may contact the law enforce- 
ment authorities with a request for site investigation. 

After operation 120, the flow routes to decision block 
122 to determine whether the change key flag is set or 
not set. 

Returning to the decision block 1 1 8, in the event that 
the Factory Mode is not the mode in which the lock 12 is 
operating, the logic path will lead directly to the Change 
Key Set decision block 122. described immediately 
above, while bypassing the clearing of the shunt relay 50 
in operation 120. In operation 122, if the change key f teg 
is not set, then there is a check for a "Delay-ln-Progress" 
in operation 124. This operation will be more completely 
described with respect to the flow diagram in Figs. 12A 
and 1 2B at a later time. 

On the completion of the check for "Delay-ln- 
Progress" in operation 124, a check for Open Audit 
Records occurs in operation 126. which similarly will be 
described with regard to the subroutine illustrated and 
described below with reference to Figs. 8A and 8B. 

After the completion of the check for open audit 
records in operation 126, the flow will continue to oper- 
ation 128 where the user is prompted by the display of 
the letters "EC" to enter his lock combination. Similarly, 
if the change key flag is set, then the flow through the 
"YES" branch from block 122 will be to operation 128 
where the operator prompt "EC" as described above is 
displayed. Thereafter, the flow enters a loop including 
operations 130 and 132. 

This flow will pass through operation 132 where the 
first operation is to determine whether any key button on 
the keypad 10 ol the lock 12 has been pressed. If there 
has been no key button pressed, then the "NO" path will 
direct the flow back through WDTO operation 110 and 
the flow again will pass through operation 130; and 
again, the determination in 132 will be accomplished. 
This looping will continue with the WDTO continuing its 
operation until either the WDTO period of preferably 40 
seconds is elapsed or a key button is pressed on the key- 
pad 10. Upon the detection of the key button press, then 
the flow will branch through the "YES" path to operation 
134 where a beeper is sounded to indicate the entry of 
a key button and the subsequent acceptance of the key 
button input by the lock 12. Thereafter the flow then will 
loop back to operation 130 where it will be determined 
whether a "Pair-In" flag has been set. Since the first key 
button will not accomplish the setting of the "Pair- In" flag, 
then the operation will continue to loop through the "NO" 
path back to operation 132 awaiting the next key button 
entry. Whenever the next key button entry occurs and 
assuming that it occurs prior to the expiration of the 
WDTO in operation 110, then a beeper will sound, again 
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in operation 134; and at that point, the flow will return to 
operation 130 to recheck the Tair-ln" flag set determi- 
nation. 

Upon the depression of any key, the WDTO period 
is reset to effectively restart the 40 second timeout. A t 
signal from the keyboard interrupt routine indicates a key 
button has been pressed and sets a flag to be tested by 
the main loop referenced above; and in so doing, upon 
the second key button being pressed, a "Pair-In" flag is 
set. Accordingly, after the second depression of a key 1 
button and the second affirmative determination in block 
132 t having been set, the "Pair-In" flag will be detected 
in operation 130 and the flow will branch from the previ- 
ously described loop to operation 136, to be further 
described in detail with regard to Fig 7 below. n 

The lock may be advantageously provided with a 
system to send a silent alarm to a central monitoring post 
whenever the operator opens the lock using a secret 
duress combination. The lock 12 will indicate to the next 
user that the silent duress alarm was sent in the prior 2c 
session and that condition needs to be reset once the 
lock is opened with a valid combination so as to not send 
a false silent alarm. This operation is provided by the 
logic described with the detailed logic flow diagram of 
Fig. 5. If the silent alarm flag is not set, then the remaining 25 
flow of Fig. 5 is bypassed. 

With respect to operation 114 in Fig. 4a, reference 
is now made to Fig 5 where the subroutine of operation 
114 is represented. Entry is indicated at "Check Silent 
Alarm" in operation 1 1 4 wherein the flow then is directed 30 
to operation 140 and additionally the Silent Alarm flag is 
checked to determine if set. In the event that the Silent 
Alarm Flag is not set indicating that no silent alarm con- 
dition occurred in the previous session of operation of 
the lock, the flow is to the return at 1 42, and subsequent 35 
return to 1 1 4, and then flow to operation 1 1 6 in Fig. 4A. 
In Fig. 5 should the Silent Alarm Flag have been set and 
detected as such in operation 140, the flow through the 
affirmative path will cause a display of "ALS" indicating 
that the silent alarm has been activated; the operator 40 
may observe that condition and be aware that the silent 
alarm had occurred or was tripped in the prior operating 
session. This operation to display "ALS" is operation 144. 
Thereafter the Silent Alarm relay is turned off in operation 
1 46 and the Silent Alarm Flag is cleared in operation 1 48. 45 
Thereafter the Silent Alarm Flag Cleared condition then 
is stored in the EEPROM memory 42 which is nonvolatile 
and retains its stored contents from operating session to 
operating session without regard to the amount of time 
between sessions. 50 

After the storage of the cleared Silent Alarm Flag in 
operation 150, the operator is given the opportunity to 
cancel the display 14 by rotating the dial 8 at least one- 
half revolution in either direction. If such a dial rotation - 
does not occur, then the WDTO of operation 1 1 0 is initi- 55 
ated and either the dial 8 is rotated at least one-half rev- 
olution thereafter, causing the flow to pass through the 
"YES" path to return 142, or the WDTO will expire and 



then cause the lock program to restart at operation 112 
in Fig. 4A. 

In order to initialize the various modes of the lock 1 2, 
add and delete users and shelve one or more modes of 
" the lock 1 2, it is necessary both to condition the lock and 
detect that conditioning by testing for the change key 48 
whenever resident in the lock. The detection of the 
change key and the control of the lock. If the change key 
48 is left in the lock 12 and the container closed and 

0 locked the lock 12 detects its presence and allows the 
lock to be reopened to retrieve the change key 48. This 
capability is described with reference to Fig. 6. 

Referring now to Fig. 6, the operation of "Check 
Change Key" in operation 116 of Fig. 4A is illustrated. 

1 Entering at the start, of operation 116, for the "Check 
Change Key" status, the flow then will be to clear the 
Change Key Flag in operation 154. Thereafter if the 
direction of the most recent rotation of the dial 8 is deter- 
mined to be clockwise in operation 156, the flow through 

> the affirmative path is to return to operation 158. How- 
ever, if the direction of the dial 8 is counter-clockwise, as 
determined in operation 156, this permits the presence 
of the change key 48 in the lock 1 2 to be ignored as might 
be required in any condition in which an operator has 
inadvertently or erroneously locked the lock 12 with the 
change key 48 inserted; therefore, the change key 48 is 
resident within the closed and locked container. In the 
event that this condition exists, the operator should turn 
the dial 8 in a clockwise direction both to permit bypass- 
ing the effect of the change key 48 as installed in the lock 
12 and to permit the lock 12 to be opened normally in 
order to retrieve the change key 48. 

Should the direction of the dial 8 be determined 
counterclockwise, then the flow path is directed to oper- 
ation 160 where a determination is made whether the 
change key 48 is installed in the lock 12. In the event that 
the change key 48 is not installed, the flow is to return 
158. Once the change key 48 is detected as installed, 
then the flow is to operation 162 where a Change Key 
Flag is set indicating that a change key operation is in 
progress and thereafter the flow is to return 158. Return 
1 58 di rects the logic flow back to operation 1 1 6 in Fig. 4 A. 

Whenever combinations or special menu selections 
are entered through the keypad 10, the lock 12 must be 
able to distinguish between the various types of entries 
and the significance of the data entered at specific digit 
locations. The distinguishing functions are illustrated in 
Fig. 7. 

Referring now to Fig. 7, operation 136 in Fig. 4B is 
illustrated in more detailed form. The "Pair Is In" subrou- 
tine is started with entry at 136 and the flow is directed 
to the determination at operation 164 as to whether the 
two digits that have been entered into the lock 12 are the 
first two digits, the first digit pair, entered into the key- 
board 10. If it is determined in operation 164 that they 
are not the first digit pair entered, then the flow will be to 
operation 166 whereby a similar determination regards 
whether the data entered is the second digit pair. Simi- 
larly if the answer to that interrogatory in operation 166 



6 



OCID: <EP 0712983A2_I_> 



11 



EP0 712 983 A2 



12 



is negative, then a determination in block 168 is made if 
it is a third digit pair; and in the event that similarly is 
answered in the negative, then the flow will be to return 
1 70, which will cause the flow to revert back to operation 
136 in Fig. 4B. In the event that the determination in oper- 
ation 1 64 is made in the affirmative, then a check is made 
at operation 1 72 as to whether the first of the digits is a 
pound (#) sign. In the event that it is not, then the flow 
will revert back to operation 166. 

However, in the event that the determination is made 
that the first character is a pound (#) sign and not a 
number, the flow will be to operation 174 which repre- 
sents special menu options to be discussed in more 
detail below. 

A similar operation 172 is found in the affirmative 
flow emanating from decision block 166 where the flow 
is to operation 1 76 whereby the entry into operation 1 76 
will require two sequential pairs of data entry, both of 
which will have the # sign as the first digit and a numeral 
as the second of each of the pairs. Upon this condition 
being satisfied, then the Special Menu 2 Options are 
accessed and the microprocessor 30 will proceed to dis- 
play for purposes of maintenance and repair, the last fif- 
teen en or coc*«*s rientrfying operational errors of the lock 
12. Ther e*npr the flow emanating from the operation in 
block 1 76 will be to the WDT0 1 1 2 which then will cause 
the operation to return to operation 1 1 2 in Fig. 4A and to 
restart the kx* operation. 

If the flow is through the negative path from either 
block 166 or 1 72. then the determination is made as ear- 
lier discussed m operation 168. Should the determina- 
tion be made tn operation 168 in the affirmative that the 
data pair or digit pair being considered is the third digit 
pair entered, then the determination is made at operation 
178 as to whether the Change Key Flag is set. Should it 
be in the affirmative, then the change key operation is 
processed in operation 180 and the flow subsequently 
goes to the WD TO, operation 112. If the determination 
made in operation 1 78 is negative, then the further deter- 
mination is made as to whether to the Super-Shelve flag 
is set in operaton 182. If the Super-Shelve flag is not set, 
the flow will proceed in operation 184 to the processing 
of the combination that has been entered and thereafter 
return to 170. in the event that the Super-Shelve Flag is 
set, then the f tow is to operation 1 86 and thus accomplish 
the processing of the super-shelve second pass as illus- 
trated in Fig 22. described and discussed below. 

Each time a lock 12 is opened, an open audit record 
is stored both in the lock 12 and the electronic key 16. 
Each ti me the lock 1 2 is closed and if the same electronic 
key 16 is used in closing, the open audit record is con- 
verted into an open/close audit record. If the lock 12 is 
closed and the close seal number is not collected into 
the electronic key 16 for the open/close audit record, it 
is necessary to collect the close seal number prior to 
operating the lock 12 again. The logic flow diagram in 
Figs. 8A and 8B is used to describe the operation of this 
aspect of the lock 12. 



Referring now to Fig. 8A and 8B, the logical flow illus- 
trated therein represents operation 126 check for Open 
Audit Records in Fig. 4B. 

Upon entry into the routine at operation 1 26. a deter- 

5 mination is made if any open flags are set at operation 
1 88 with a negative determination resulting in a return at 
operation 190 to operation 126 operation 190. Should 
the existence of any open audit flags be determined in 
operation 188, the affirmative path is followed to opera- 

w tion 1 92 wherein the operator is prompted by the display 
of "IP1" on the lock's display 14 to place his electronic 
key 16 into the socket 18 to effect the insertion of the 
personal identifier into the lock 12. The Touch Memory 
manufactured by Dallas Semi-conductor of Dallas, 

is Texas, is one such type of electronic key; nevertheless, 
it should be understood that other types of memory stor- 
age can be utilized including proximity detectable iden- 
tifier cards/badges or magnetic readable cards, which 
may be read either through a "swipe type" reader or by 

20 other conventional magnetic card apparatus. Although 
understanding that the alternative memory systems 
could be used, the discussion with regard to this elec- 
tronic lock will focus primarily on the Touch Memory type 
produced by Dallas Semi-conductor. In any event, the 

25 data contained in any of the other alternative non-volatile 
memory devices would be the same. 

One advantage found in the Touch Memory of the 
Dallas Semi-conductor type is the little can or key which 
contains a serial number unique to that particular device 

30 which cannot be erased, altered, or changed in any way 
thereby permanently and reliably identifying that specific 
identification device. 

Thereafter in operation 194 the personal identifier's 
serial number, the can/key type, security ID, the time, the 

35 user ID, customer number, and company or branch ID 
are read from the key 16 to the lock's memory in order 
to secure data necessary to operate the lock 12. 

It should be noted at this point that entry into this 
routine at operation 1 94 may be accomplished from spe- 

40 cial menu #4, as will be discussed later. 

In operation 196 the key data is searched and 
checked to determine whether an open flag is set for that 
particular electronic key 16 type. In the event that the 
determination is in the negative, then the flow is to return 

45 to operation 190. Should the determination be in the 
affirmative in operation 196. the matching open record 
then is read from the EEPROM 42 in operation 1 98. The 
determination then is made at operation 200 if this is the 
same key 1 6 as that identified in the flagged open record. 

so In the event that the keys 1 6 are the same, indicating the 
same operator is re-accessing the lock 1 2 to access the 
Close Seal, thef lowthen is to operation 202; the previous 
open record will be converted into an Open/Close 
Record and stored back into the EEPROM 42. 

55 At operation 200, should the present key 16 be 

determined not to be the same as the opener, then it 

must be another individual attempting to access the lock 
12, and the EEPROM 42 then will be written with a "Close 
Only" audit record so that the previous transaction will 
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be closed. Moreover, it is Ifidieated that it Is being closed 
by a user of a different identity than the one who opened 
the lock 12 end created the open reeord. After operations 

204 t where the Close Only Audit Record is written, or 
operation 202 where the open audit is converted to an 5 
Open/Close Audit Record, the flow is to the operation 
206 where the Open Record Flag is cleared as illustrated 
in Fig. 8B. 

The preceding steps in this subroutine effectively 
clear up and change the flags and audit records in the u 
EEPROM 42 to reflect the identities of the keys 16 being 
used to close the lock 12 and the flow proceeds to oper- 
ation 208 which begins accomplishing the same general 
operations with respect to the information written into 
and stored in the user's Touch Memory key 16. In oper- is 
ation 208 the same key flag is tested; and if it is set. then 
the flow indicating that the same key 1 6 is used to access 
the last Touch Memory audit memory in the key 16 in 
operation 210 and determine in operation 212 if the last 
Touch Memory audit record is an open record. Should it 20 
be, then operation 214 determines whether the serial 
number and the Seal Count in the Last Touch Memory 
Open Audit Record are equal to those values stored in 
Last Open Audit Record of the EEPROM 42 of the lock 
1 2. If those values are equal to their stored counterparts 25 
in the lock memory as determined in operation 214. the 
affirmative path is followed and the touch memory 16 
then is rewritten to create an Open/Close Audit record in 
operation 216. Thereafter the Shunt Relay 50, also 
referred to as the Alarm Relay 50, is turned off in 218, 30 
indicating the retraction of the lock's bolt 20 to be used 
in conjunction with customer supplied sensors and logic 
for additional alarm capability. 

Returning to operations 212 and 214, in the event 
that a determination made in one of these operations is 35 
made that either the audit record is not open or the Touch 
Memory Serial Number and Seal Count do not equal the 
corresponding values in the lock EEPROM, then the neg- 
ative path is followed to cause the writing of a Close Only 
audit record in operation 220, which then would indicate 40 
that the Lock Audit Record has been closed by a key 16 
which was not the opener or did not have identically the 
same information -therein as was stored in the lock mem- 
ory. Similarly, should the determination of the same key 
flag in operation 208 result in a negative determination, 45 
that flow is directed then to operation 220 for the same 
purpose. 

After the Shunt Relay 50 is turned off in operation 
218, the next operation is to determine whether the key 
1 6 is a Bank Key in operation 222. In the event that the so 
key 16 is in fact a Bank Key, the affirmative path is fol- 
lowed to operation 224 where the flow is directed to go 
to the "EOP-TOP" or End Operation-Top Of the Program 
and will re-enter at operation 112. 

In the event that the key 16 is determined not to be 55 
a Bank Key in operation 222, the negative flow path will 
then go to the display operation where the symbol "c" 
plus the Close Seal, a two digit number, are displayed 
with the "c" preceding the two digit number to indicate 



that the number is a Close Seal Value. The previous 
operating session is completely closed. 

Thereafter, the flow is to operation 228 where the 
operator may enter a dial 8 rotation of at least one-half 
revolution after noting the Close Seal value to continue 
the operation. In the event that dial 8 is not rotated by at 
least one-half revolution, the flow reverts through the 
negative path to the WDTO operation 110 which will 
eventually cause a return to the top of the program and 
> re-enter at operation 112 on expiration of the timeout 
period. If the half revolution is observed and determined 
to have occurred in operation 228, then the flow goes to 
operation 224. 

Operation 184 in Fig. 7, the "Combo Is In" routine is 
the portion of the program that controls the acceptance 
of the combination entered through the keypad 1 0 of lock 
12. The routine functions after the six digits of a combi- 
nation have been entered. The electronic controls of the 
lock 12 are operated to detect whether the lock 12 is in 
factory mode, single operator mode, dual operator mode, 
or bank mode; and if in bank mode, whether a delay in 
opening is operative. If the lock 12 is operating in a dual 
mode, either of the operators may enter his/her combi- 
nation and key 16 first, but both required combinations 
and keys must be entered to ultimately open the lock 12. 

Anytime lock 12 is operating in the bank mode and 
in delayed opening mode, the lock 12 must be opened 
subsequent to a preset delay and during a preset window 
period following the delay period. The delay period starts 
with the correct entry of the combination and key 16 or 
combinations and keys 16, if in dual mode. 

Referring now to operation 184 found in Fig. 7, the 
processing of the "Combo Is In" subroutine will be further 
explained with reference to Figs. 9A, 9B and 9C. Figs. 
9A, 9B and 9C illustrate the subroutine contained in oper- 
ation 1 84 and entry is indicated at operation 1 84 wherein 
the lock 12 is checked at operation 230 to determine if 
the lock 12 is presently set and operating in Factory 
Mode. Factory Mode is the condition in which the lock 1 2 
is shipped to the customer by the factory. It is also a con- 
dition provided in which one can practice using the lock 
1 2 without causing the conditions to change, necessitat- 
ing dispatched combinations or an electronic key 16 to 
cause the lock 12 to function properly. 

Further, the Factory Mode is the lock condition 
whenever all modes of the lock 1 2 are shelved. Shelving 
the lock 1 2 applies a specially dispatched key 16 in order 
to return the lock 12 to a condition whereby it can be 
placed on the shelf or "stored," and/or then reinstalled 
on another container at a later date without any need to 
maintain a continuous history of combinations entered 
into the lock 12; typically, the combination for the lock 12 
is returned to a standard predetermined "Factory" Com- 
bination. 

Once the lock 12 is operated and a combination 
entered, determination at operation 230 will be in the 
affirmative and the flow then is directed to operation 232 
is compare the entered combination with the factory 
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combination; and if equal, the flow goes to the affirmative 
path to the Release Lock Operation 234. 

Should the Compare/Equal Condition in operation 
232 not be satisfied, then the path flow is through the 
negative branch to operation 236 where a lightning bolt 5 
is caused to be displayed on the LCD 14 of the lock 12, 
indicating an error. Return now to operation 230 to deter- 
mine that the lock is not in a Factory Mode, i.e., it has 
been installed and is fully operational in its intended one 
or more other modes. Then the path will follow the neg- 
ative route to operation 238 and the determination as to 
whether or not this is the second combination entered of 
a dual combination pair. In the event of an affirmative 
determination, the second operator's personal identifier 
i.e.. the electronic key 16, is requested by the displaying 
of 1P2" on the LCD display 14 in operation 240. The 
Touch Memory or other suitable identifying memory 
device then is read into a buffer 46 of the lock 1 2 and the 
Personal Identifier Serial Number and the can type of the 
key 16 then are read from the key 16 and stored in the 
buffer 46 to identify both the user and the key 16 being 
used. In operation 242 thereafter a determination is 
made as to whether this is the identical key 1 6 previously 
used to enter the first combination. In the event that there 
is an affirmative determination, then the second combi- 
nation is being entered by someone using a single key 
16 for both identification processes and an error condi- 
tion exists; the flow therefore is to operation 236. 

In the event that the operation in 238 is determined 
to be in the negative, i.e., the lock 12 is not requesting a 
second combination, then the flow is directed to opera- 
tion 244 where there is a determination made as to 
whether the combination entered has been entered as a 
Confirmation Combination, by testing whether the Con- 
firmation Combination Flag is set. In the event that the 
determination is in the negative, the combination is 
thereby determined to be an opening combination and 
the operator is prompted to identify himself by displaying 
of "IPl", which stands for "Insert Personal Identifier r. 
This also will represent the first combination being 
entered inasmuch as it has been previously determined 
not to be the second combination. 

The same information is read from the key 16 and 
stored in the buffer 46 in operation 246 as was read and 
stored in operation 240. 

After operation 246, the key data is stored in the ran- 
dom access memory 44 of the lock 1 2 in operation 248. 
At this point it should be noted that should the same key 
16 not be used twice as determined at operation 242, 
then the flow is to operation 248 where the key data read 
and stored in the buffer 46 in operation 240 is transferred 
to the random access memory 44 of the lock 12 in oper- 
ation 248. After operation 248. the LCD display 14 is 
cleared in operation 250, an indication to the operator 
that it is permissible to remove the key 16 from the key 
socket 18 of the lock 12. 

Thereafter in operation 252. the can type, key type, 
and the lock modes are all compared against a table 
stored in the memory of the lock 12 to determine whether 



this is an appropriate key 16 for the lock operation as 
presently configured. In the event that the key 16 type or 
can type of the lock 1 2 are inappropriate for the particular 
configuration of the lock 12. then the operation will go to 
an error condition within the operation and will cause a 
lightning bolt and error code display 14. 

In the event that resolution occurs successfully, the 
flow is to the Combination 2 Flag Set determination step 
in operation 254. In the event that the Combination 2 Flag 
is set as determined in operation 254. there is a subse- 
quent determination of operation 256 in Fig. 9B as to 
whether the key 1 6 being used is a bank key. 

Upon a negative determination of the Combination 
2 Flag Set or an affirmative determination of the Con- 
firmed Combination Flag Set decision in operation 244, 
the flow is from the respective operations to operation 
258 in Fig. 9B where the Seed Combination, Master 
Combination, Closed Seal, and Seal Count for the cur- 
rent key type are retrieved from the non-volatile memory 
of the lock and compared with corresponding values 
stored in two other locations within the lock 12 memory. 
Retrieval of the information from plural locations guards 
against the inadvertent or undesired destruction of the 
data in one location and permits the lock 12 to function 
and remain usable as long as two of the three stored 
locations favorably compare. Referring again to decision 
256. with a positive or affirmative determination that it is 
a Bank Key 16. the information is retrieved in operation 
258 in a like manner. 

The path from operation 254 through operation 256 
to operation 258 insures that for Bank dual mode, the 
retrieval of the Seed Combination, Master Combination, 
Closed Seal, and Seal Count Data is retrieved a second 
time but not for the Route or FLM users, enforcing the 
requirement of a dual dispatched pair of users. 

In the event that the determination in operation 256 
is that the key 16 is not a Bank Key. then the flow will 
pass to operation 260 where the microprocessor 30 will 
use the Seed Combination, Master Combination, Closed 
Seal, and Seal Count data retrieved in operation 258 to 
generate a real combination for the lock 12. Referring to 
operation 258, after the retrieval of and selection of the 
data that is identical for at least two of the three storage 
locations, the determination is made whether this a con- 
firming combination by checking in operation 262 the 
Confirmed Combo Flag to determine if set or not. If this 
is not a confirming operation, i.e., it is an opening oper- 
ation, then and the flow is to operation 260 wherein the 
Real Combination is generated. If the entered combina- 
tion in fact is a confirming combination as indicated by 
an affirmative determination for operation 262. then the 
flow is through the affirmative path to return operation 
264 and subsequent return to the main loop of the pro- 
gram for additional user input. 

Upon the generation of the real combination in oper- 
ation 260. the Entered Combination is compared to the 
Real Combination in operation 266 and if a com- 
pare/equal condition exists, the flow will be through the 
affirmative path. Conversely, if the determination is found 
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to be unequal, then the flow will be to operation 268 
where the Combination 2 Flag is determined as either 
Set or Not Set. if the Combination 2 Flag is in a Set con- 
dition, then the affirmative determination will result in a 
flow from operation 268 through the affirmative path to 
operation 236, indicating an error. This reflects the fact 
that the combination did not compare and that this is the 
second pass of dual mode operation. However, if the 
Combination 2 Flag is Not Set, then the flow will be to 
operation 270 where a determination is made as to 
whether the key 16 is a Route key; and if it is not a Route 
Key, then this is an error condition resulting in the flow to 
operation 236. In the event that operation 266 results in 
an affirmative determination indicating that the Entered 
Combination and the Real Combination do compare, 
then the path is to operation 272 where a determination 
is made as to whether the lock 1 2 is set up in dual mode 
requiring two combinations and two keys 16 of this par- 
ticular key type, being Route, first line maintenance, 
(FLA/I), or Bank Mode Operation. 

If the lock 12 is not in Dual Mode for this particular 
key type, then the negative flow path will result in a rout- 
ing to operation 274 wherein all data associated with the 
opening of the lock 12 is saved. This operation will be 
explained in mor e detail later. 

After the data has been stored in operation 274. the 
Open Lock Release subroutine functions in operation 
276 to create the conditions to allow the lock 12 to be 
released for opening Thereafter the shunt relay 50 is 
turned ON in operation 278 and the lock 12 awaits a 
counterclockwise rotation of the dial 8. If no such rotation 
occurs, then the WD TO is set in operation 280; upon the 
expiration of that time period, the WDTO will cause the 
lock 12 to be reset and require re-entry at operation 112 
in Fig. 4A. 

The counterclockwise rotation of the dial 8, the direc- 
tional rotation detected in operation 282, will indicate that 
the lock 12 is being closed and will cause the lock elec- 
tronic controls to return to the Power On Reset, operation 
100, Fig. 4A. 

Returning to operation 272, in the event of an affirm- 
ative determination that the lock 12 is in a Dual Mode for 
this particular key- type, then the Combination 2 Rag set 
condition is determined at operation 284. Should the 
Combination 2 Flag Set status be affirmatively deter- 
mined, then the flow path is to operation 274 and the flow 
will continue through the remainder of the flow path to 
either WDTO 280 and a reset condition or to operation 
110. 

In the event of a negative determination in operation 
284, then the Combination 2 Flag is set The display 14 
then will show "EC2" to prompt the operator to enter the 
second combination at operation 288. Thereafter the 
flow is to return to operation 290 which will return theflow 
to the main loop at operation 184. 

At this point, return to operation 270 in Fig. 9C 
wherein determination of the Route Key 16 has been 
made. If this key 16, resident in key socket 18, is noted 
as a Route Key, the affirmative path will be followed first 
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to operation 292 wherein the second possible real com- 
bination is generated and subsequently to operation 294 
wherein the generated combination and the entered 
combination are compared. In the event of an affirmative 
5 determination of a Compare Equal Condition at opera- 
tion 294, the Seal Count will be incremented at operation 
296 and the f tow then will be directed to operation 272 
in Fig. 9B where the operation of the logic will continue 
as previously described with the remainder of the flow 
10 path. However, if in operation 294 the Entered and the 
Generated Combinations are unequal, then the lock will 
generate the third possible real combination in operation 
298 of Fig. 9C, thus permitting up to three people to be 
dispatched to the same lock 12, on a single dispatch 
is operation. Upon the generation of the third possible com- 
bination for the lock, the determination at operation 300 
will detect whether the Entered Combination and the 
third possible Real Combination are equal. Upon a deter- 
mination that they are unequal, an error condition is 
20 detected to exist and the flow is directed to the operation 
236 to indicate an error. 

However, with a positive or affirmative determination 
in operation 300, the flow will pass to operation 302 
wherein the Seal Count is incremented, and the flow then 
25 will pass to operation 296 where the seal count is incre- 
mented a second time before the flow is directed to oper- 
ation 272 in Fig. 9B for completion of operations. The 
double incrementations of the Seal Count as the flow 
passes through both operations 302 and 296 are not only 
30 necessary to keep both the dispatch computer and the 
lock in synchronism with regards to the data needed in 
order to generate future combinations, but also serve to 
eliminate the accessibility by the previous combinations. 
This lock 12 uses several pieces of data unique to 
35 each individual lock 1 2 to generate those combinations 
to operate the lock 12. The pieces of data are stored in 
redundant locations to insure continued availability of the 
data to the microprocessor 30. A more detailed explana- 
tion of the routine of operation 258 in Fig. 9B follows with 
40 reference to Fig. 10. 

Referring back to operation 258 where the Seed 
Combination, Master Combination, Closed Seal, and 
Seal Count data are retrieved and checked, this subrou- 
tine is expanded and described with respect to drawing 

45 10. 

From the entry of the routine at operation 258, the 
determination is made as to whether the key 16 is a 
Route Key. If the determination is made in the negative 
in operation 320, then the flow is to operation 322 where 
so the key 16 is checked to determine whether it is a FLM 
key. In the event that it is determined not to be a FLM 
key, then the negative flow path is to operation 324 where 
the key 16 is checked to determine if it is a Bank key. If 
the determination is in the negative, an error condition 
55 exists because the key 16 must be one of a Route Key, 
a FLM key, or a Bank key. Therefore, the flow is to oper- 
ation 236 where a lightning bolt and an error code are 
displayed on LCD 14 to indicate an error condition. 
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Should the determination in operation 320 or the 
operation in 322 be resolved in the affirmative, then the 
flow is directed to operation 326 where the Seed Com- 
bination, Master Combination, Closed Seal, and Seal 
Count data for the particular key type are retrieved to the s 
locks RAM 44. In the event that there is a discrepancy 
between the retrievals of the data from the three storage 
locations, then the data represented by the best two of 
the three locations is retrieved. Once the information has 
been retrieved, compared, and additionally two of the w 
three locations found to favorably compare, then the flow 
continues with operation 327 wherein a determination is 
made of the set status of the Change Combination Flag. 
If the flag is Set, the flow branches to operation 336. If 
the flag is not Set. the flow is to Return operation 328 15 
whereby the return is directed to operation 258. 

Referring back to operation 324 wherein the key 16 
is tested to determine whether it is a Bank Key; upon an 
affirmative determination, the flow then will be directed 
to an operation where the bank user identified by the 20 
Bank Key is subsequently verified by reference to the 
table of bank users stored within the non-volatile memory 
of the lock 12. operation 330. Once the Bank User's 
Record is found in the memory of the lock 1 2. a determi- 
nation is made whether the bank user is a new user; 25 
upon a negative determination, i.e. he is not a new user, 
then the flow is directed to operation 334 where the Bank 
Users Seed Code is retrieved to the RAM 44 of the lock 
12. And then the flow continues through operation 326 
to the remainder of the flow diagram. 30 

Should the determination be made in operation 332 
that the bank user is a new user, then the flow will 
progress to initialize the new Bank Users record in oper- 
ation 336. The subroutine of this process will be 
described in more detail with respect to subroutine illus- 35 
trated in Fig. 16. 

The pieces of data from which each combination is 
calculated changes for Route and FLM users with each 
opening of the lock 12; these pieces of data must be 
recalculated, encrypted and stored into the lock memory 40 
along with some of the data being stored in the user key 
16. The Save Open routine of operation 274 is explained 
in more detail with reference to Fig. 11. 

In Fig. 1 1 upon entry into operation 274, the flow will 
be to operation 340 wherein the prompt will ask the oper- 45 
ator to insert his personal identifier by displaying IP1 on 
the LCD display 14 of the lock. The insertion of the key 
16 into the key socket 18 will allow the lock 12 to get or 
retrieve personal identifier data, i.e. the can type and the 
serial number of the key 1 6. Thereafter the Touch Mem- so 
ory or key 16 is read to retrieve the key type and the time 
maintained by the Touch Memory 16. in operation 342. 
Thereafter the Current Seal Count is incremented in 
operation 344 and the key type is checked to determine 
whether the key 16 is a Bank Type Key in operation 346. 55 
If the key 16 is not a Bank Type Key. then in operation 
348 the new Seed Combination, the Master Combina- 
tion, and the Close Seal are recalculated as appropriate 
to provide the data from which the next user combination 



will be generated. Thereafter the flow is directed to oper- 
ation 350 wherein the power supply 32 is latched to pre- 
vent the loss of power during data storage. 

Thereafter in operation 352, an Open Only Lock 
Audit Record is compiled and written into the EEPROM 
42 and an Open Only Key Audit Record then is compiled 
and written into the electronic key 16 or Touch Memory 
in operation 354. The flow then is directed to operation 
356 wherein the Seed Combination, Master Combina- 
tion, Close Seal, and Seal Count records then are written 
into the three locations for that particular key type. There- 
after the. routine returns in operation 358 to operation 
274. Referring to operation 346 wherein the key 16 was 
tested to determine if it was a bank type key; upon an 
affirmative determination, operation 360 will check to 
determine whether there is a Delay in Progress. The 
Bank Mode of operation is the only mode of operation 
which will accommodate a delay in opening following the 
entry of a valid combination or combinations and key 
insertions. 

In the event that a delay is in progress at operation 
360, the affirmative path then will direct the flow to oper- 
ation 362 where the End Delay Flag is cleared. Subse- 
quently, the flow is directed to operation 350 where the 
power supply 32 is latched and the remaining portion of 
the flow path is traversed as described earlier. In opera- 
tion 360 in the event that there is no Delay in Progress, 
then operation 364 will build and write into the EEPROM 
42 of the lock 12 a new delayed Open Data Record. 
Thereafter the flow of operations will be to operation 362 
and following operations previously described. 

The building and the writing of a New Delayed Open 
Data record in operation 364 will be described with more 
detail later with regard to Figs. 12A and 12B. 

The Bank mode of operation allows a delay in open- 
ing to be inserted between the correct entry of a combi- 
nation and the actual opening of the lock 12 and 
container. During the delay, there is no lock activity and 
the operator may attempt to proceed with opening. The 
microprocessor 30 must check to see if a delay is in proc- 
ess prior to proceeding with the opening of the lock 12. 
Routine 124 in Fig. 4b and further illustrated in Figs. 1 2A 
and 12B explains the checking procedure to ascertain 
whether a delay is in progress. 

Referring now to Figs. 12A and 12B, the flow dia- 
gram in these figures expands and illustrates operation 
124 in Fig. 4B. The lock 12 is capable of delaying opening 
for a preset period of time after entry of a correct or 
authorized combination and user key insertion. In the 
bank mode only, this type of delay is possible. It is nec- 
essary at operation 124 in Fig. 4B to check rf a delay is 
in progress. That determination is made at operation 
370. Fig. 12A. In the event of a negative determination, 
the flow is diverted to operation 372 wherein the flow 
returns to operation 124 in Fig. 4B. 

On the other hand, if a determination in operation 
370 is in the affirmative, then the operator will be 
prompted to identify himself by a visual prompt W IP1 n dis- 
played on the LCD 14 of the lock 12. The touch memory 
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or the electronic key 16 is read and the data transferred 
to the buffer 46 to acquire and store the personal identi- 
fier's serial number and can type of the key 16, which is 
inserted into the electronic key socket 18 of the lock 12. 
This all occurs in operation 374. Thereafter In operation 
376, the key 1 6 again is queried, as is the buffer 46, for 
information stored during operation 374 to acquire the 
key data which comprises the personal identifier's serial 
number, can type, security ID, time, user ID, customer 
number, and the company or branch ID; all data is stored 
permanently or transiently in the Electronic Key 16 or 
Touch Memory Container. Thereafter, a determination is 
made at operation 378 as to whether the key 1 6 that has 
been inserted into the key socket 18 is or is not a Bank 
Key. Upon a negative determination, the flow path 
branches to operation 380 wherein clearance of the In 
Delay ^iag occurs, indicating that a delay is not in 
progress, and then the flow is to return operation 372. 

In the event that the type of the key 1 6 is determined 
to be a bank key in operation 378, the EEPROM 42 is 
read to acquire the Delayed Open Data Record in oper- 
ation 382, and then the flow continues with decision block 
384 where a determination is made as to whether the 
key 16 used to initiate the delayed opening is the same 
key 16 that was just entered into the key socket 18. If the 
determination concludes that the same key 16 or the 
same user is not still in control of the lock 12, then the In 
Delay Flag is cleared in operation 380 and the flow is 
directed again to operation 372 for a return to the oper- 
ation 124, Fig. 4B. 

If the key 16 inserted into the lock 12 upon the most 
recent request is in fact the same user key 16, then the 
flow is through the affirmative path to operation 386 
where a check is made to determine as to whether the 
time read from the key 16 exceeds the previously calcu- 
lated delay end time. In the event that the delay end time 
has been exceeded or, stated differently, that the delay 
period has expired, the affirmative path is followed to 
operation 388 to a determination whether the time pres- 
ently exceeds the end of the previously calculated win- 
dow end time. If so the delay period must be restarted; 
in so doing, the flow is through the affirmative path to 
operation 380 described previously. In the event that the 
time has not exceeded the Window End Time, then the 
flow is through the negative path and the EEPROM 42 
of the lock 1 2 is read in operation 390 to determinate the 
Seed Combination, Master Combination, Close Seal, 
and Seal Count record for the key type that has been 
inserted into the socket 18. 

Thereafter, the flow is to operation 392 where the 
logical control flow is directed to "Save Open" operation 
274 found in Fig. 9B; and the flow of control will result 
ultimately in the opening of the lock 12. In the event that 
the determination made in operation 386 is that the time 
has not exceeded the delay end, then the NO flow path 
is followed and a calculation is made in operation 394 to 
determine the number of minutes left in the delay period. 
The flow is thereafter to operation 396 where the minutes 



left in the delay period are displayed, preceded by a "d" 
to indicate "delay," on the LCD display 14. 

Thereafter the flow is to operation 398 where the 
lock dial 8 is monitored to determine whether the dial 8 
5 has been rotated a one-half turn in either direction. 
Should movement of the dial 8 sufficient to satisfy this 
condition not be detected, then the negative branch will 
be followed and the WDTO in operation 1 10 will monitor 
lock operations until the end of the timeout period. The 
10 entire process will be restarted at operation 112 if the 
timeout period expires without the awaited input. In the 
event that at any time during the 40 second timeout 
period the condition in operation 398 is satisfied, the 
timeout will be terminated and the flow will branch 
is through the affirmative path to operation 400, prompting 
the operator that the "End Of Procedure" has been 
reached by the LCD 14 displaying "EOP" and then 
returning the flow to operation 1 1 2 as illustrated in Fig. 
4A. 

20 Refer back to operation 364 shown in Fig. 1 1 , a new 
"Delayed Open" data record is created. Operation 364 is 
expanded and tied into the operations illustrated in Fig. 
1 2A at operation 364, indicating a start of the new delay. 
Thereafter, at operation 402, the EEPROM 42 is read to 

25 retrieve the "Delayed Open" data record and a determi- 
nation based on that record is made in operation 404 if 
the initialized delay time is greater than zero. 

In the event of a negative determination, the "In 
Delay" flag is cleared in operation 406; and in operation 

30 408, the flow returns to operation 364. Should there be 
a determination in operation 404 that the delay is greater 
than zero based upon the Delayed Open data record 
retrieved in operation 402, the Users ID is moved in oper- 
ation 41 0 to the buffer 46 and then the flow is directed to 

35 operation 41 2, where the end time of the delay is calcu- 
lated and also subsequently inserted into the buffer 46. 
In operation 414 the Window End Time is calculated and 
also stored in the buffer 46. Operation 416 writes the 
combined information of the user's ID, the Delay End 

40 Time that has been calculated, and the calculated Win- 
dow End Time into the EEPROM 42 as the Delayed 
Open Data Record. Thereafter the In Delay flag is set 
and stored in operation 418 to indicate that a delay is in 
progress; the number of minutes in the delay are calcu- 

45 lated in operation 394 with the flow from 394 as previ- 
ously described. 

This lock 1 2 requires certain inputs for security integ- 
rity before it will allow changes in its operation., The 
Supervisor Audit Key 16 is the only type of key that can 

so be used to change the operation of the lock 12, in con- 
junction with the change key 48. The change key 48 and 
Supervisor Audit key 16 are required for operation of a) 
the Initialize Mode function; b) Shelve Mode function; c) 
Add Bank User Function; and d) Delete Bank User func- 

55 tion. 

With respect to the flow diagram in Figs. 13A and 
13B, the Change Key Operation should be understood 
to be where the parameters of the lock 12 are either 
entered or changed. In order to accomplish the changes 
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contemplated and controlled by the presence or absence 
of the change key 48, the lock 12 must be opened, the 
container opened, and the change key 48 inserted into 
the change key port 49 of the lock 12. 

Expanding on operation 180 found in Fig. 7, entry s 
into this subroutine is indicated in Figs. 1 3 A and 1 3 B des- 
ignated as Change Key In at operation 180 and, there- 
after the lock 12 will ask for or prompt the operator to 
insert a Supervisor Audit Key, one of the several types 
of keys 1 6 that may be used with the lock 1 2. The Super- w 
visor Audit Key 1 6 is a key which permits only the holder 
to operate the lock 12 and/or make changes in its oper- 
ating parameters. Upon the insertion of the Supervisor 
Audit Key, as prompted in operation 430, the Electronic 
Key 16 or Touch Memory is read into the lock buffer 46 is 
and the can type and the serial number of the key are 
stored. 

Thereafter in operation 432, additional information 
is read from the key 16 to store in the lock's Random 
Access Memory or RAM 44. The information stored in 20 
the RAM 44 includes the can type, personal identifier 
serial number, the key type and the time stored in the key 
1 6 by the dispatch system. In operation, 434 the can and 
key types together with the Lock Mode are resolved to 
determine if the combined information results in legiti- 25 
mate factors for the lock 12, as presently configured. 

Thereafter the flow is directed to operation 436 
where the key type is tested to determine whether the 
key 16 is an Initialize Mode Key. Upon an affirmative 
determination, the display 1 4 will show a "Ini" to provide 30 
visual feedback to the operator that the lock 12 is in an 
initializing mode in operation 438; and thereafter in oper- 
ation 440, the process of initializing the lock 12 in one or 
more modes occurs and will be expanded, as further 
described below. 35 

Upon the completion of the initialization of the lock 
12 in one or more modes, the display 14 will prompt the 
operator to pull out the change key 48 by displaying 
"POC" in operation 442; and thereafter in operation 444, 
the lock 12 will test to detect if the change key 48 is 40 
removed. In the event that the change key 48 is not 
removed, then the WDTO operation 110 will be tested 
and should the change key 48 not be removed within the 
timeout period, then the timeout expiration will return the 
operation of the lock 12 to the START operation 1 12 in 45 
Fig. 4A. If the change key 48 is removed during the pre- 
determined timeout period, then the affirmative path is 
followed to operation 446 where the flow is directed to 
operation 234, see Fig. 9A, and the lock 12 is released 
for opening. so 

Return now to operation 436. If the key type is not 
an Initialize Mode key, then the negative flow path will be 
followed to operation 448 where the key type is tested to 
determine whether it is a Shelve Mode key 16. If so, then 
the affirmative path will be followed to operation 450 ss 
where the operator is provided visual feedback that the 
lock 12 is in a Shelve Mode by displaying "SHL" and 
thereafter processing the Shelve Lock routine in opera- 
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tion 452. Operation 452 will be described in more detail 
below. 

After operation 452 has been completed, the flow is 
to operation 442 and to subsequent processes previ- 
ously described. 

In the event that the determination in operation 448 
is that the key type is not a Shelve Mode key 16, then in 
operation 454 a determination is made to detect if the 
key 16 is of the type which will add one or more bank 
users to the authorized users list. Upon an affirmative 
determination that the key type is the type which is to be 
used for adding additional bank users to the authorized 
bank user list, the display 1 4 will prompt the operator with 
"Add" indicating to the operator that the lock 12 is in an 
"Add" mode in operation 456. Operation 456 is followed 
by operation 458 where bank users are added to the 
authorized user list stored within the lock's memory. 
Thereafter the flow is to operation 442 and subsequent 
operations as previously described. 

Upon the test 454 resulting in a negative determina- 
tion, operation 460 will test the key 16 to determine if it 
is a Delete Bank User key 16. In the event that a negative 
determination is made, that finding combined with the 
failure to find an appropriate key type in operations 436, 
448, 454, or 460 results in an error, and the flow then is 
to operation 462 which displays an error lightning bolt 
and the control of the lock returns to operation 1 12 as 
shown in Fig. 4A. 

Upon a positive or affirmative determination in oper- 
ation 460, the display 14 will prompt in operation 462 the 
operator by displaying "dEL" on the LCD display 14 and 
thereafter in operation 464 will delete one or more bank 
users from the authorized list. Operation 464 will be 
described in more detail later. 

The flow from operation 464, similar to the flow from 
operation 440, 452, 458 is directed to operation 442 and 
subsequent operations as previously described. 

At this point a high level overview of the initialization 
of the lock 12 in this embodiment will prove helpful. A 
lock 12 can be initialized from the factory mode or from 
a condition wherein one or more modes of the lock have 
been initialized previously, and now an additional mode 
needs to be initialized and rendered operational. 

The initialization operations vary slightly depending 
upon whether the lock 12 is in Bank Mode or already 
operating in at least one mode. If in Bank Mode with the 
change key 48 inserted in the lock 1 2, the dial 8 is rotated 
to power up the lock 1 2, resulting in the display 1 4 exhib- 
iting a "change key symbol* 1 and the letters "EC" on the 
three digit display of this embodiment of the lock 12. 

For those locks 12 that have been previously been 
placed in service in one or more modes of operation, the 
lock*12 must be first opened by the use of the electronic 
key 16 and the entry of a dispatched authorized combi- 
nation. Thereafter, the change key 48 is inserted in the 
lock 12 and the dial 8 turned left to bring up on LCD 14 
the "change key symbol" and the letters "EC as above. 
From this point on, the initialization process is essentially 
identical. 
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The factory mode of the lock 12 is checked and a 
"Factory Combination" is entered for the mode being ini- 
tialized and initialization key is used. The initialization key 
contains the data necessary to identify the mode to be 
initialized and the other data necessary for the lock 12 5 
to generate the combination for the lock to operate and 
to thus generate the various pieces of data necessary 
for the next operation of the lock 1 2 in that mode at some 
future time. 

After the initializing operations have been con- 10 
eluded, the lock 1 2 must then be closed using the same 
electronic key 16 that was used to open the lock 12 ini- 
tially. With the opening and the closing as well as the ini- 
tialization, audit records are created. Because the 
Initialization Audit Record will be bracketed in time by the is 
Open Record and the Close Record, which will clearly 
identify the user and the mode that granted access to the 
lock 12 for the initialization, accountability is maintained 
and a user may not initialize a mode of a previously oper- 
ating lock 12 without another user being involved. 20 

Anytime the lock 1 2 is to be initialized in Bank Mode, 
at the displaying of "Change Key Symbol" and "EC", the 
factory combination must be entered and then the user 
number must be entered so that the proper user file is 
created and stored in the Bank Mode User Table. 25 

In order to simplify the programming of operations 
440. 458. and 464 and because the three processes are 
substantially identical, a single subroutine illustrated in 
Figs. 14A and 14B and entered at operation 470 in Fig. 
14A has been devised which will satisfy the needs of 30 
each of those processes for performing its own unique 
function. Because operations 440, 458 and 464 are 
essentially identical from a logic flow standpoint, and 
only use different input data, a single logic flow has been 
devised to operate as the respective routine dependent 35 
upon whether the function is to Initialize Modes, Add 
Bank Users or Delete Bank Users. 

Referring now to operation 470, in Figs. 14A, indi- 
cated as "Start: Init/Add/Del" the entry into operation 470 
is from operations 440, 458, or 464. Thereafter the flow 40 
is to operation 472 wherein the entered combination is 
tested to determine whether it is the factory combination; 
and upon a negative determination, the flow diverts to 
operation 236 which is an error condition and causes the 
display of the lightning bolt on the LCD 1 4 to indicate to 45 
the operator that an error has occurred. Upon an affirm- 
ative determination in operation 472, the flow is to oper- 
ation 474 where the "One Lock Initialized" and "Last 
Record Set" flags are cleared. These flags will be used 
later in connection with the processing of these records, so 
Thereafter, in operation 476 the Touch Memory or the 
electronic key 16 is read to retrieve record #1 of a lock 
set. The flow continues downward from operation 476 to 
operation 478 where the Next Record 1 Pointer is saved 
or the Last Record Flag is set. 55 

Thereafter the flow continues to operation 480 
where the lock 1 2 serial number from the key 1 6, buffered 
in operation 430, is checked against the lock serial 
number in this data record. In the event that the lock 



serial number and the buffered lock serial number from 
the key 16 are not equal, then the flow is to operation 
482 where the Last Lock Set flag is checked to determine 
whether it has been set. If the Last Lock Set flag has not 
been set, then the negative flow path directs the flow to 
operation 476 and subsequent operations. If the Last 
Lock Set flag in fact has been set, a determination is 
made in operation 484 as to whether the "One Lock Ini- 
tialized" flag has been set. In the event that the "OLI" flag 
has not been set, then the flow is through the negative 
path to operation 236 which causes a lightning bolt to be 
displayed on the LCD 14. 

If the "one lock initialized" flag has been set as deter- 
mined in operation 484, the affirmative path is followed 
to cause the return operation 486 and the return to oper- 
ation 440, 458, or 464, whichever is the appropriate ori- 
gin of operation. 

Refer back to operation 480, a Compare Serial 
Number Equal operation. The flow is directed through 
the affirmative path to operation 488 where a determina- 
tion is made as to whether this transaction set is com- 
plete or record set is used. In the event of an affirmative 
determination, the flow is to operation 482 and subse- 
quent operations as previously described. 

If the determination of operation 488 is made in the 
negative and the transaction set is not complete, then 
the determination in operation 490 is made to determine 
whether the key 16 last inserted in the key socket 18 is 
an initialize Mode key. Should the key 16 be an initialize 
Mode key, then a new mode of operation from the key 1 6 
is added to the previous modes or old modes of operation 
and to the key type in operation 492; flow then 
progresses to operation 494 where the customer number 
and company/branch ID is moved from the key 16 to the 
RAM 44 of lock 12. Thereafter in operation 496 the cur- 
rent Seal Count for that mode of operation is initialized 
to "0001 " and stored. In the event of the negative deter- 
mination that the key 16 is an Initialize Mode key in oper- 
ation 490 or upon flow coming from operation 496, the 
dispatch time stored in the key 16 is moved to the lock 
RAM 44 and the Transaction Set Complete flag is set. All 
of this occurs in operation 498. Thereafter, in operation 
500, the electronic key 16 or Touch Memory is re-written 
to record the "Processed Transaction Complete Flag" to 
indicate that this record has been processed and need 
not be processed again. In operation 502 the Touch 
Memory Record Pointer is incremented. Then the Key 
Type is tested to determine whether the key 16 is a bank 
key in operation 504. If the key type in is fact a bank key, 
the affirmative path then will be followed to determine 
whether it is also an initialize mode key as well in oper- 
ation 506. If the key 16 is not an initialize mode key, then 
the negative path from operation 506 leads to operation 
508 where the addition or deletion of the users to the 
authorized user list is accomplished, and the flow then 
is directed to operation 514 to be described below. 

Referring back to the bank key type determination 
in operation 504, if a negative determination results, 
"Record 2 of the set" is read from the electronic key or 
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Touch Memory 16 to the buffer 46 at operation 510 and 
thereafter, in operation 512, the data from the key is 
decrypted and stored in the RAM 44 of the lock 12. The 
decrypted data is the Seed Combination, the Master 
Combination, and the Close Seal value. Thereafter the 5 
flow is directed to operation 514 where the EEPROM 42 
is written to record the Seed Combination, the Master 
Combination, the Closed Seal, and the Seal Count 
record for that particular key type in three separate mem- 
ory locations in the lock memory for security and relia- w 
bility. 

In operation 506 if the key 16 is an initialize mode 
key, then the flow is through the affirmative path to oper- 
ation 51 6 where both the common bank data of the mas- 
ter combination and the Close Seal value are initialized 15 
for all bank users. Thereafter, the entire Bank Users 
Table and the In Delay flag are cleared in operation 518 
and the flow is directed to operation 508, previously 
described. 

From operation 508 the flow is to the previously 20 
described operation 514, and to operation 520. where 
the EEPROM 42 is read and then modified to contain the 
new customer initialization data for this key type such as 
the customer number and the company or branch ID 
number for this key type. That data is rewritten into the 25 
EEPROM 42. Thereafter in operation 522 an Audit 
Record reflecting the operations previously performed, 
i.e.. Initialization/Add User/Delete User, is built and writ- 
ten into the audit memory of the lock 1 2. In operation 524 
"A Lock Initialized" flag is set and the flow directed to 30 
operation 482 and subsequent operations, as previously 
described. 

At this point, please refer to Figs. 1 5A and 1 5B which 
are flow charts expanding operation 508 as shown in Fig. 
14B. Upon entry into 508 the Last User Flag is cleared, 35 
the Close Seal is cleared in operation 530 and Touch 
Memory 16 is read to secure the user record in 532. 
Thereafter the user ID is moved to the RAM storage 44 
of the lock 12 in operation 534 and a determination made 
as to whether this user ID identifies the last user for this 40 
lock 12 in operation 536. Upon a positive or affirmative 
determination in operation 536. the Last User Flag is set 
in operation 538 and a random Seed Combination for this 
user is generated in operation 540. In the event that the 
user ID code does not reflect that this is the last user in 45 
operation 536, the negative path will go directly to oper- 
ation 540 and bypass 538. Thereafter the user's ID is 
used to search the EEPROM 42 to verify if this user's 
entry already exists in the users' table in operation 542. 

In operation 544 a determination is made as to so 
whether the user has been found. Upon a negative deter- 
mination of whether the user was found in the user table 
at operation 544, the negative path flows to operation 
546 where the key 16 is checked to determine whether 
it is a Delete User Key. If the key 1 6 is a Delete User Key ss 
and the user was not previously found, then an error con- 
dition exists and the affirmative path is followed to alert 
the operator by a beep of the speaker at 550; the flow 
then passes to operation 552 where the "Inter Record 



Pointer" is incremented and the "Inter Record Pointer" is 
verified to learn if it has passed the end of the current 
record in operation 554. If the query of operation 554 is 
answered in the affirmative, the flow route is directed 
back to operation 534, the loop in this record; and if the 
determination in operation 554 is in the negative, then 
the flow is directed to operation 532 where the loop con- 
tinues with the next user record. 

Returning to operation 546 if the key 16 is not a 
Delete User Key, the negative path isfollowedto thedeci- 
sion block of operation 558 to determine if the key 1 6 is 
an add user key. in the event that the key 16 is not an 
Add User Key, the speaker is beeped in operation 550 
and the flow continues as previously described. 

However, if the key 16 is found to be an Add User 
Key in operation 558, then the flow is directed to opera- 
tion 560 where an open user slot in the EEPROM 42 
users table is found; the user's ID and new user flag are 
stored in that open user slot in operation 562. This user 
record then is immediately written into the EEPROM 42 
at operation 564. Should the identified user have been 
found in operation 544, the flow is to the affirmative path 
to operation 556 where the key 16 is tested to determine 
whether it is an Add User Key; and if the determination 
in operation 556 is in the affirmative, then the speaker is 
beeped in operation 550 and the flow continues there- 
from as previously described. However if the key 16 is 
not an Add User Key. then the test is made in operation 
566 to determine whether the key 16 is a Delete User 
Key. In the event that the key 16 is not a Delete User Key, 
then the speaker is beeped in operation 550 with the flow 
continuing as previously described. 

Should the key 16 be a Delete User Key, then the 
user's entry is cleared from the buffer 46 in operation 568 
and the flow is directed to operation 564 as previously 
described. 

Following operation 564 the electronic key or Touch 
Memory 1 6 is re-read and the current Add or Delete User 
Record is retrieved in operation 570. Thereafter in oper- 
ation 572 the key 1 6 is marked or flagged to indicate both 
that this user has been processed and will not be reproc- 
essed and also as feed-back to the dispatch system indi- 
cating the user has been accepted into this lock 12 
whenever the key 1 6 is returned to the dispatch system. 

In operation 574 the Touch Memory or electronic key 
16 has the current user record written thereunto, and 
then the flow is directed to operation 576 where the Last 
User Flag is tested to determine whether the flag was 
been previously set. If the last user flag has not been 
previously set, the flow then is to operation 552 and sub- 
sequent operations as previously described. 

However if the Last User Flag in fact has been set. 
then the affirmative flow path is followed to operation 578 
where an Add or Delete Users Audit Record is built and 
written to the EEPROM 42. Thereafter the flow is to the 
return operation 580 which returns to operation 508. 

The process of initializing New Bank User operation 
336 in Fig. 1 0 is expanded in the flow diagram of Fig. 1 6. 
Operation 336 in Fig. 10 is entered in Fig. 16 at the 



15 



Z\D: <EP 0712fiB3A2J_> 



29 



EP 0 712 983 A2 



30 



START operation 336. In operation 590 the Confirmed 
Flag is tested to determine if it has been previously set 
in Pass 1 . If the Confirmed Flag has not been previously 
set, the negative path is followed to operation 592 and 
the determination made as to whether the entered com- 5 
bination is equal to the factory combination . If the entered 
combination is equal to the factory combination, then a 
random Seed Combination is generated for this user in 
operation 594 and the Seed_OK flag is set in operation 
596. Thereafter the remainder of the Seed Combination, 10 
Master Combination, Close Seal, and Seal Count data 
is retrieved from the EEPROM 42 and at least two of the 
three sets of data retrieved from the three different mem- 
ory locations in which the data was stored are compared; 
and of those which do compare, at least two out of three 75 
are used in subsequent calculations. The retrieval oper- 
ation is operation 598. In operation 600 the real combi- 
nation for the lock 12 is generated and the new user's 
real combination then is flashed or displayed on LCD 14 
to the user in operation 602 allowing the user to record 20 
or memorize the new combination. The new user's com- 
bination continues to be displayed until such time as the 
Reset Button (the Asterisk Button) is detected as 
pressed in operation 604. 

Prior to the detection of the depressed Reset Button 25 
in operation 604, the negative control path directs the 
logical control to the WDTO function 110 and will con- 
tinue to do so until either the Reset Button is detected as 
having been depressed or the WDTO period elapses; in 
either case, the control of the lock 12 will return to oper- 30 
ation 112 in Fig. 4A. Upon detection of the depressed 
Reset Button, the affirmative flow path is to operation 606 
where Confirm Combination or "CC" is displayed; and 
thereafter the flow goes to return 608 which causes the 
flow to return to operation 336 and eventually return from 35 
thereto the main loop, operation 136 and the loop of 
operations associated therewith awaiting operator input. 

Referring to operation 590, where the Confirmed 
Flag is tested to determine whether set, an affirmative 
determination results in flow to operation 61 0 where the 40 
entered combination is compared with the operation 600 
generated real combination. Upon a Compare Unequal 
Condition, the negative flow path indicates an error and 
the flow from operation 610 is diverted to operation 236. 
Similarly if the determination in operation 592 is in the 45 
negative, the flow will be directed to operation 236 indi- 
cating an error. 

Returning now to operation 610, upon a Compare 
Equal Condition, the New User and Change Combina- 
tion Flags are cleared in memory in operation 612. In so 
operation 61 4 the EEP ROM 42 is written to store the new 
Seed Combination to the user's record. Thereafter in 
operation 61 6 the Activate User Audit Record is built, and 
written into the EEPROM 42. Thereafter in operation 618 
the operator is LCD 1 4 prompted with "EOP" that the pro- 55 
cedure is terminated and the flow is returned to the top 
of the program and re-enter at operation 112. 

The Shelve Mode of lock operation is selected to 
remove one or more modes of operation from the lock 



12 after it has been initialized and removed from factory 
mode. The Shelve Mode permits resetting some of the 
operational characteristics of the lock 12 or permits 
returning the lock 12 to a condition equivalent to factory 
mode for storage in a standard predefined condition and 
mode of operation awaiting further use. 

The Shelve Mode requires the use of a Supervisor 
Audit key 16 which is coded as a Shelve Mode key and 
the predetermined factory default combination. 

Referring now to Figs. 17A and 17B, Shelve Mode 
operation 452 of Fig. 13B is illustrated in expanded form 
and will be described in additional detail. Upon entry into 
the subroutine at operation 452, the control flow is to 
operation 630 where the entered combination is com- 
pared with the factory combination; and upon a negative 
determination of the equality, the flow is to operation 236 
to blink the lightning bolt on the LCD display 14. Upon a 
favorable comparison in operation 630, the "A Lock Ini- 
tiated** and "Last Record Set" flags are cleared in oper- 
ation 632 and the pointer to the Touch Memory Record 
1 is initialized in operation 634. Thereafter in operation 
636 the Touch Memory 1 6 is read to retrieve the first/next 
Record 1 of the Lock Set and the next Record 1 pointer 
is saved in operation 638 or, alternatively the Last 
Record Flag is set. 

Thereafter the buffered lock serial number from the 
electronic key or Touch Memory 1 6 is compared with the 
lock's serial number to determine equality; and with 
equality, the affirmative path is followed from operation 
640 to operation 642 where the Transaction Complete 
Flag is tested to determine if this record set has already 
been processed. In operation 640 if the buffered lock 
serial number from the electronic key 16 is not equal to 
the lock serial number, then the flow is to the last Lock 
Set determination in operation 644. In operation 644 if 
the Last Lock Flag is not set, then the negative flow path 
is directed to operation 636 and will continue to loop until 
it finds a record which belongs to this particular lock 12. 
With regard to operation 642 if the transaction is deter- 
mined to be complete, the flow path similarly will take the 
affirmative path and return to operation 644 and then 
subsequently continue to loop. In the event that the trans- 
action is found not to be complete in operation 642, the 
flow is to operation 646 where the new mode is deleted 
from the current modes and added to the key type for 
later use. 

The flow thereafter is to operation 648 where the dis- 
patcher's time is. moved from the key 1 6 to the lock RAM 
44 and the Transaction Complete flag is set. Thereafter 
the Touch Memory 16 is written with Record 1 of the set 
in operation 650 and the Shelve Mode Audit Record is 
built and written into the EEPROM 42 in operation 652. 
Following the writing of the Shelve Mode Audit Record 
into the EEPROM 42, the "A Lock Initialized Flag" is set 
and the flow is directed therefrom to operation 644. If the 
Last Lock Set flag is determined to be set in operation 
644, the affirmative path is followed to operation 646 
where A Lock Initiated Flag set is tested; and if the deter- 
mination is in the negative, an error condition exists and 
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the flow goes to operation 236 to display the lightning 
bolt on the LCD 14. In the event that the determination 
in operation 656 is in the affirmative, then the flow is to 
operation 658 where the control is returned to operation 
452 in Fig. 13B. 5 

To better understand the function of the Process 
Special Menu Options step found in operation 1 74. of 
Fig. 7. reference is now made to Fig. 1 8A and 1 8B. Upon 
entry into operation 1 74 the decision is made in opera- 
tion 680 as to whether the second character of the pair 
of characters entered into the lock 12 in operation 172 
has a second character equal to 1. Upon a negative 
determination, the flow is directed to operation 682 for 
testing the second character for the value 2. If in opera- 
tion 680 the second character is equal to 1 , the Display 
Locks Code and Hardware Levels operation is proc- 
essed. The lock's codes and hardware levels with head- 
ers are displayed sequentially and continue to loop 
through the display headers and data until such time as 
the operator cancels the display with the asterisk button 
on touch pad 10. the WDTO period expires, or the lock 
12 powers down. Operation 684. upon completion, then 
will go to WDTO operation 1 1 2 and will cause the return 
to the START on Fig. 4A operation 112. The determina- 
tion in operation 682 in the affirmative will cause the con- 
tinuous display of a header and the lock's serial number, 
unless or until interrupted by the operator canceling the 
display operation 684. and then the flow will be to oper- 
ation 112. 

If the determination in operation 682 is in the nega- 
tive, meaning that the second character of the pair is 
otherthan the numeral 2, then the determination in oper- 
ation 688 is made as to whether the second character is 
equal to the value 3. In the event of a Compare Equal for 
the value 3. operation 690 will cause a header and the 
lock's total seal count to be displayed. Thereafter the flow 
is directed to operation 1 12 as described earlier. 

If the determination in operation 688 is in the nega- 
tive, then the second character is compared with the 
numeral 4 in operation 692; and if the character is a value 
of 4, then the process in operation 694 will prompt the 
operator to insert the electronic key 1 6 and then will dis- 
play a header and the closed seal count for that key type 
continuously until interrupted by the operator. Thereafter 
the flow is to the WDTO in operation 1 12. 

If the second character of the pair being considered 
is not a value 4 in operation 692. then the second char- 
acter is tested to determine if it is a value 5 in operation 
696. If the determination in operation 696 is one of equal- 
ity, then the LCD display 14 will show a prompt of n ?T 
indicating that the operator may enter a further pair of 
codes. In the event that the next pair of codes that is 
entered is again value 5. then the operation 698 will 
cause the continuous displaying of a header and the last 
15 error codes that were determined in the operation of 
the lock 1 2 continuously until interrupted by the operator; 
then the flow will go to operation 112. In the event that 
the condition tested in operation 696 is hot satisfied, the 
negative flow path will lead to operation 700 where the 



second character of the pair is tested for equality to the 
value 8. Upon an affirmative determination of equality, 
the Change Bank Users Combination subroutine oper- 
ates in operation 702 and will be expanded on and 
explained in more detail below. 

If the test for the value 8 in operation 700 is not con- 
firmed, then the second character is subsequently proc- 
essed and tested in operation 704 for a value of 9. Upon 
a Compare Equal Condition for the value 9, the Super 
Shelve Pass One process will be operative in operation 
706. The operation of Super Shelve Pass One of opera- 
tion 706 will be described and expanded upon below. 

If the compare operation in operation 704 fails in 
testing for equality, then the second character of the pair 
is tested for equality with "0"; and if the compare equal 
condition is satisfied, then the audit records of the lock 
are dumped in operation 710. The Audit Dump is accom- 
plished by storing the audit dump information from the 
lock 12 into the Supervisor Audit Key 16 that is placed in 
the key socket 18 after prompting by process 710 to be 
expanded on and explained in more detail below. This 
key 16 then may be returned to the dispatcher tor anal- 
ysis and report generation. 

If the comparison in operation 708 is a Compare Not 
Equal, then the second character of the pair is tested for 
equality with the "#"; and in the event that there is no 
compare equal, an error condition exists and the condi- 
tion in operation 712 is not satisfied. Thereafter the flow 
will go to operation 236 indicating the error condition. 

If the condition tested in operation 712 is satisfied, 
then the operator is prompted to insert his electronic key 
16. The electronic key is sampled to determine the key 
type and a header and the seal count for that key type 
then is continuously displayed until interrupted by the 
operator in operation 714 on the LCD 14. Upon the com- 
pletion of each of the processes 702, 706. 710. and 714, 
the flow from each is to operation 1 1 2 to the WDTO oper- 
ation 110. 

The lock 12 has several functions not directly 
involved in its opening and closing but which contribute 
to the control of the security of the lock 1 2 itself and pro- 
vide information additionally that is advantageous in the 
monitoring of the lock use of the lock such as the ability 
to be able to determine directly from the lock the hard- 
ware level of the circuit board and the microprocessor 
code level in the lock 1 2, to use in diagnosing many prob- 
lems in its operation. Additionally, the lock's serial 
number may be accessed, the Total Opening Counter 
contents for the lock may be displayed, the last Close 
Seal for a particular key type may be acquired, the last 
15 error codes may be displayed for maintenance, and 
the current seal count for the key type may be displayed 
and loaded into the key 16. Additionally, the Change of 
a Bank User Combination or a Lock Super Shelve func- 
tion may be initiated. These operations are permitted 
through the entry of a code number in the form of "#X" 
X being is a numeral or a and upon entry, the function 
or operation is selected. These functions and their indi- 
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vidual operations are explained in more detail with refer- 
ence to Fig. 19. 

Refer now to Fig. 1 9 which illustrates the expansion 
of operation 702 found in Fig. 18B; operation 720 sets 
the Change Combination Flag and thereafter the display 
1 4 shows M ECC" in operation 722 to prompt the operator 
to enter his/her current combination. Thereafter the flow 
is to return operation 724 where the return is to operation 
702 and eventually back to the main operation as shown 
in the main loop in Figs. 4A and 4B. The operation of the 
control software will continue at that point through the 
"Pair In" and "Combo In" flow diagrams to allow the user 
to enter his/her current combination, have the user's new 
combination displayed via the Initialize New User flow 
diagram and confirmed via the same flow path a last 
time. 

Referring now to operation 710 and Fig. 17B, that 
subroutine is further expanded in Figs. 20 A and 20B; and 
upon entry into operation 710, operation 730 will prompt 
the operator into inserting the Supervisory Audit Key 16, 
and the key 1 6 will be read to the buffer 46 of the lock 1 2 
to store the can type and the serial number of the key 16. 

Thereafter in operation 732 data from the key 16, 
namely the key type and the company ID. will be 
retrieved. At this point a determination is made in oper- 
ation 734 as to whether the lock 1 2 is operating in factory 
mode; and if affirmative, key 16 is tested to determine 
whether it is an Audit Key in operation 736. In the event 
that it is not an Audit Key then an error condition exists 
and the error display will be triggered in operation 236. 

In the event that the lock 12 in fact is not operating 
in the factory mode, then the customer number and the 
company ID are tested to determine whether they match 
any similar data in the key 16. In the event that the num- 
bers do not match any of the similar data in the key 16, 
then an error condition exists and operation 236 is acti- 
vated to display the lightning bolt on the LCD 14. In the 
event that a matching customer number and company 
ID in fact are found, the affirmative path is followed to 
testing whether the key 16 is an Audit Key in operation 
736. The customer number and the company ID match 
determination is conducted in operation 738. 

After the key 16 is tested and determined to be an 
Audit Key in operation 736 and has been so found, the 
affirmative path is followed to operation 740 where the 
display 14 then will show "Aud" to indicate to the operator 
that an Audit Dump is in process and therefore the oper- 
ator should not remove the key 16 from the reader or 
socket 1 8 until the Audit Dump is complete. At that point, 
an Audit Dump Audit Record is built and written to the 
EEPROM 42 in operation 742. Thereafter in operation 
744 the lock's EEPROM audit pointer and serial number 
are written to the Touch Memory or the electronic key 16 
for dispatch system use once the key data is retrieved. 

Thereafter a determination is made in operation 746 
as to whether all of the audit records have been sent to 
the key 16; and in the event that the determination is 
YES, then the flow is to operation 748 which will to dis- 
play "EOP" and return control of the microprocessor 30 
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to operation 112. In the event that all records have not 
been sent, then the EEPROM 42 of the lock 12 is read 
to retrieve the next Audit Record in operation 750 and 
the Audit Record then is written to electronic key or Touch 
5 Memory 16 in operation 752. Thereafter the record is 
marked as "read" for future reference by the dispatch 
system in operation 754 and the Audit Record is written 
back to the EEPROM memory in operation 756. There- 
after the determination in operation 746 is repeated and 
w will continue to loop until such time as all records have 
been sent to the supervisor audit key; at which point the 
flow is to operation 748. 

Referring now to Fig. 21 operation 706 shown in Fig. 
1 will be explained and expanded in detail. 
is This mode, referred to as Super Shelve, allows the 
opening of a lock and its return to a shelved condition 
even when the lock will not operate in response to prop- 
erly dispatched combinations, a condition that may occur 
when the dispatching computer and the lock are not in 
so synchronization for any reason. 

Upon entry into the Super Shelve First Pass, oper- 
ation 760 causes the display of "ISA" to prompt the oper- 
ator to insert Supervisory Audit Key and then the key 16 
is read and data transferred to the buffer 46 to store the 
25 key ID and the can type. Thereafter in operation 762 the 
data stored in the key 1 6 is retrieved, specifically the key 
type and the dispatch time. In operation 764 the key type 
is tested to determine whether it is equal to a Super 
Shelve key; and in the event that it is not. the flow goes 
30 to operation 236 indicating an error and the displaying of 
the lightning bolt on the LCD display 14 of the lock 12. 

If on the other hand the determination in operation 
764 is in the affirmative, then the Locks ID Record is 
located in the Supervisory Audit key in operation 766 and 
35 the key 1 6 is read in operation 768 to get the next record. 
Thereafter in operation 770 the Super Shelve Flag 
is set and the Touch Memory 1 6 is written to in order to 
clear the first Record of the key 16 and thereby prevent 
the reuse of the key 1 6 on any lock 12 including this one, 
40 in operation 772. In operation 774, the display 14 will 
show "ESS" to prompt the operator that the Super Shelve 
Combination is to be entered into the lock 12. Thereafter 
in flow operation 776, the return is to operation 706 in 
Fig. 18B. Eventually the flow will revert back to the main 
45 program as shown in Figs. 4A and 4B to permit operator 
entry of additional data or information into the lock 12 as 
appropriate. 

Referring at this point to Fig. 22, operation 186 found 
in Fig. 7 will be expanded and explained. 
so Upon entry into operation 1 86, a real combination is 
generated at operation 780 and both the entered combi- 
nation and the real combination are compared in opera- 
tion 782. In the event that the two combinations do not 
compare, an error condition exists and the lightning bolt 
55 will be displayed in operation 236. 

If the two combinations in fact do compare then, they 
Compare Equal and operation 784 will remove and save 
all the modes of the lock 1 2. reverting to the factory mode 
and thereby shelving those modes of the lock 12. There- 
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after operation 786 will dear the Super Shelve Flag and 
a Super Shelve Audit Record is built and written to EEP- 
ROM 42 in operation 788. The flow from operation 788 
is to operation 790 where the End Of Process prompt is 
displayed on the LCD 1 4 and there is a return of process 5 
control to the Top Of the Program at operation 1 12. 

The Super Shelve operation provides a very valua- 
ble operation or function to be performed with the lock 
12. Circumstances may occur after the lock 12 is 
unpacked, installed on a container, and is functioning 10 
well into the use and, then for some reason, the lock and 
dispatch system will become hopelessly unsynchro- 
nized. As this occurs, the dispatch system cannot create 
a lock combination to function in the designated lock 12; 
the only apparent alternative is to open the safe by phys- is 
ical means such as drilling or other destructive tech- 
niques. In many cases the lock 12 is ruined or unusable, 
which is a relatively expensive entry and therefore is an 
undesirable approach to solving the inoperability of the 
lock. The destructive entry also may destroy or severely 20 
damage the container, which frequently is considerably 
more expensive than the lock itself. Only initiated and 
operated with a combination and a key 16 supplied by 
the lock manufacturer, the Super Shelve function can 
permit under very controlled circumstances the shelving 25 
of the lock 12 to factory condition whenever the lock 12 
otherwise would be totally inoperable. Super Shelve also 
will serve to re-synchronize the lock 12 and the dispatch 
system from known data points and will then permit the 
lock 12 to continue to be used once the Super Shelve 30 
program has been operated and the lock re-initialized. 

One of skill in the art will appreciate that while certain 
pieces of data have been specifically identified and 
described in the identifying of the user, the lock, and 
other values used in the generation of the combinations, 35 
it may be desirable to and well within the abilities of a 
skilled programmer to select and use other values so 
long as the function performed provides the necessary 
level or degree of security. Such changes and modifica- 
tions should not remove the device from the scope of the 40 
attached claims which define our invention. 

Claims 

1. An electronic self -powered combination lock com- 45 
prising: 

a dial knob connected to a generator provid- 
ing electrical power for said lock; 

electronic controls powered by said genera- 
tor; so 

data entry means for actuation to enter com- 
bination and initialization data; 

an electronic key; 

means for accepting said electronic key con- 
nected to said electronic controls; ss 

moans for reading the contents of said key; 

means for combining portions of said key 
contents with data stored in said lock; 

comparison means for comparing said com- 



bined data with an authorized combination, said 
authorized combination generated by said lock, and 
if compared equal, conditioning said lock to be 
opened; 

at least one alternate control path for accept- 
ing alternate data and a different said key for oper- 
ation of said lock; 

means selectable to require one or two sets 
of entered data from said keys and from said data 
entry means to operate said lock; 

means for recording date, time, personal 
identifier, and close seal number for each opening 
and closing of said lock. 

2. The lock of claim 1 wherein operation of said at least 
one alternate flow path for accepting alternate data 
is dependent upon the successful acceptance of one 
authorized combination and the insertion and 
acceptance of one electronic key. 

3. The lock of claim 2 wherein said operation of said 
alternate flow path is conditioned upon the insertion 
of a second electronic key of the same type as the 
said electronic key. 

4. The lock of any preceding claim, wherein said alter- 
nate flow path permits the use of a combination and 
a unique electronic key to override the need to enter 
said authorized combination. 

5. The lock of any preceding claim further comprising 
means for transferring said recorded date, time, per- 
sonal identifier and close seal number to an elec- 
tronic key. 

6. The lock of any preceding claim, further comprising 
means for establishing authorized combinations for 
use by a plurality of classes of electronic keys and 
generation of an authorized combination for only the 
class of said electronic key read by said lock. 

7. The lock of claim 6 where said electronic key read 
by said lock is the most recently read key inserted 
into said lock. 

8. The lock of any preceding claim, wherein said 
authorized combination or combinations is/are gen- 
erated at the time of attempted entry into said lock 
by the combination of data unique to said lock, data 
contained in said key, and data that changes with 
each operation of said lock. 

9. The lock of any preceding claim wherein said alter- 
nate control path permits data read from a unique 
one-time use key and a unique combination to return 

said lock to a mode of operation the same as the 
mode of operation that said lock was in upon receipt 
from its manufacturer. 
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10, The lock of claim 9 wherein said lock further com- 
prises means for establishing authorized 'combina- 
tions for each use by a plurality of classes of 
electronic keys and generation of an authorized 
combination for only the class of said electronic key 
read by said lock and said lock may be returned to 
a mode of operation for selected modes of operation 
with selected classes of said electronic keys the 
same as the mode of operation that said lock was in 
upon receipt from its manufacturer. 
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The lock of any preceding claim, wherein the data 
entry means comprises a keypad with data entry key 
buttons. 



12. An electronic combination lock comprising: 

a dial knob for opening said lock; 

electronic controls for controlling the opera- 
tion of said lock; 

data entry means for activation to enter com- 
bination and initialization data; 

an electronic key; 

means for accepting said electronic key con- 
nected to said electronic controls; 

means for reading the contents of said key; 

means for combining portions of said key 
contents with data unique to said lock; 

comparison means for comparing said com- 
bined data with an authorized combination, and if 
compared equal, conditioning said lock to be 
opened; 

at least one alternate control path for accept- 
ing alternate data and a different said key for oper- 
ation of said lock; 

means selectable to require one or two sets 
of entered data from said keys and from said data 
entry means to operate said lock; 

means for recording date, time, personal 
identifier, and close seal number for each opening 
and closing of said lock. 

1 3. The lock of claim 1 2, including any of the features of 
claims 2-11. 
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15. The lock of claim 14 wherein said electrical control 

is comprised of a relay controlled by said electronic 
computer. 

1 6. The lock of claim 1 5 wherein said relay controls said 
alarm signals within a circuit monitoring a condition 
external to said lock. 

17. The lock of Claim 16 wherein said relay, responsive 
to said electronic computer enables and suppresses 
signals of a silent alarm circuit. 

18. A vault lock and building alarm system, wherein an 
alarm is activated when a person enters a room, but 
is suppressed when the person correctly opens a 
locked vault in the room, the suppression ending 
when the vaulted is relocked, and the alarm contin- 
uing until the person has left the room. 

19. A lock assembly comprising an electronic self-pow- 
ered combination lock and key means having a clock 
circuit therein, the lock including means for reading 
date and time information from the key and for stor- 
ing it in the lock. 



14. An electronic lock for securing a vault and for con- 
nection to an alarm comprising: 

an electronic computer control for accepting 
data to operate said lock; 

a bolt operative under the control of said elec- 
tronic computer control; 

an electrical control responsive to said elec- 
tronic computer control, said electronic computer 
control turning said electrical control on upon the 
locking of the said lock and turning said electrical 
control off upon the unlocking of said lock. 

whereby said electrical control suppresses 
alarm signals of an alarm circuit when said lock is 
open and enables said alarm signals when said lock 
is locked. 
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(54) Electronic combination lock 

(57) An electronic combination lock (12) has the 
capability of generating an opening combination by 
combining data read from an electronic key (16) and 
data unique to the lock (12) and stored in the lock. The 
key (1 6) may also include a clock circuit and memory, so 
that the lock (12) may read log the time of its opening 
and closing and the details of the user without needing 
to run a clock itself. The lock may be operated in a mode 
that requires two combinations and two separate keys 
(16) to open it. This mode is possible in several classes 
of operation such as Route, First Line Maintenance or 
Bank Mode. The lock (12) also has a mode of operation 
whereby it may be shelved or returned to a factory mode 
by using a unique combination and a one-time use key 
(16) for assistance whenever combinations are severely 
out of synchronization with a dispatching computer arid 
without other correction options. The lock may also dis- 
able a silent alarm when correctly opened. 
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